High-dimensional quantum key distribution using dispersive optics 
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We propose a high-dimensional quantum key distribution (QKD) protocol that employs temporal 
correlations of entangled photons. The security of the protocol relies on measurements by Alice 
and Bob in one of two conjugate bases, implemented using dispersive optics. We show that this 
dispersion-based approach is secure against general coherent attacks. The protocol is additionally 
compatible with standard fiber telecommunications channels and wavelength division multiplexers. 
We offer multiple implementations to enhance the transmission rate and describe a heralded qudit 
source that is easy to implement and enables secret-key generation at up to f 00 Mbps at over 2 bits 
per photon. 



Quantum key distribution (QKD) protocols 
[T] employ correlations between quantum states 
to establish secret keys between two parties that 
can subsequently be used to share secure mes- 
sages. High-dimensional correlations enable the 
generation of multiple bits per photon (bpp) 
and could enable faster generation of the se- 
cret key, potentially greater robustness to noise 
[2], and more ideal number state statistics [3J. 
A range of degrees of freedom of photon pairs 
has been investigated for this purpose, including 
position- momentum [3] , time [5J [B] , energy-time 
[7J [5], and orbital angular momentum (OAM) 
[U [TU] . Temporal correlations are particularly 
appealing because they are robust during propa- 
gation through single-mode fiber and free space. 

We consider a protocol in which two parties, 
Alice and Bob, build a secret key by measuring 
temporal correlations between two entangled 
photons. These photons are prepared by spon- 
taneous parametric down-conversion (SPDC) in 
a superposition state with a lifetime given by 
the coherence time of the pump field, (T co h, and 
correlated to some correlation time, <7 cor , de- 
termined by the phase matching bandwidth of 
the SPDC source. cr co h can be as long as a mi- 
crosecond for a standard diode laser, and cr cor is 
on the order of hundreds of fs to several ps for 
typical SPDC sources [TT]. While the resulting 
number of information eigenstates [12], given 



by the Schmidt number K m cr co h/<7 cor = d, 
can therefore be quite large [5J, security ulti- 
mately limits K < 100 for practical scenar- 
ios. These high-dimensional correlations were 
employed for QKD [T3], but to our knowledge, 
no security proof of this protocol exists. Here, 
we propose a high-dimensional temporal QKD 
protocol that is secure against general coher- 
ent attacks and relies on measurements by Al- 
ice and Bob in two conjugate bases. We show 
that measurements in both bases are possible 
using only single-photon detectors and simple 
dispersive optics. We call this protocol disper- 
sive optics QKD (DO-QKD). 

We first outline our QKD protocol and intro- 
duce group velocity dispersion (GVD). We then 
show that GVD can be used to switch between 
measurement bases and show that this protocol 
can be secure against general coherent attacks. 
Finally, we discuss practical implementations of 
the protocol in which a secret-key capacity of 
~ 3 bits/photon may be achieved, with com- 
munication possible over ~ 250 km of fiber. 

To start, Alice shares a clock with Bob and 
generates a biphoton state via SPDC. For a 
weak pump at frequency uj v and operation at 
frequency degeneracy, the down-converted state 
can be approximated by 

\^ab) = [[ ^{t A ,t B y^ {tA+tB) \t A t B ) dt A dt B , 
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where 

^(t A ,t B )oce- ( - tA - t ^ 2 /^e-^ tA+t ^ 2 / 16 ^\ 

(1) 

\t A ,t B ) = a A (t A )a B (t B )\0), and a AB (tj) de- 
note the creation operators at time tj for Alice 
and Bob, respectively. 

We let Alice and Bob measure randomly in 
one of two conjugate bases, i.e., bases that rep- 
resent time states or superpositions of those 
time states, as outlined in Fig. [TJa). Alice 
and Bob measure the arrival times of their pho- 
tons, switching randomly between bases. After 
transmission, they publicly compare the bases 
of their measurements; as in BB84, they keep 
only those frames, during which they measured 
in the same basis. They build the key based on 
the correlated timing events |13) and use error 
correction and privacy amplification |14j to re- 
duce errors and minimize an eavesdropper Eve's 
information. 

To measure superpositions of time states, the 
authors in Ref. [7] considered spectral measure- 
ments. However, spectral measurements require 
at least as many detectors as spectral channels, 
increasing system cost and noise due to dark 
counts. We propose to use dispersive elements 
to transform between measurement bases. 

We consider second-order dispersion (SOD), 
which is characterized by the parameter fa = 
d 2 /du! 2 (n c ffLu/c), where n c g is the effective in- 
dex of the mode, w is the mode frequency, and c 
is the speed of light in vacuum. A second-order 
dispersive element imparts a phase on each fre- 
quency state <j> oc /?2^ 2 PS]- Physically, /?2 is 
proportional to the linear change in the group 
velocity as a function of frequency. The SOD 
operator is unitary and its frequency domain 
representation, A is diagonal. We call the time 
domain representation U . 

Classically, a transform-limited pulse is 
spread in a dispersive medium as its frequency 
components move out of phase. However, it was 
shown that if photons of I^ab) are sent through 
dispersive media, in the limit of large er co h, o" C or 
becomes 

a ^°L + {p2AL A + f32BL B ) 2 (n . 




FIG. 1: (a) Alice and Bob measure in either the 
time or dispersed-time basis. In case (1), Alice mea- 
sures in the dispersed-time basis and projects Bob's 
photon onto a dispersed state. In case (2), she 
projects Bob's photon onto an undispersed state. 
They only obtain correlated results if they mea- 
sure in the same basis. QC represents quantum 
communication and CC represents classical commu- 
nication, (b) An equivalent prepare-and-measure 
scheme. Alice uses the arrival time of her photon 
as a sync time sent to Bob. She then chooses with 
an active switch (S) whether or not to apply dis- 
persion and modulates the delay on Bob's photon 
using a Gaussian modulator (GM) composed of a 
variable delay driven by a Gaussian-distributed ran- 
dom number generator. 

where /3 2j 4 (/?2b) is the GVD introduced by 
Alice (Bob) over length L A (L B ) [IB]. Sup- 
pose L A = L B = L and /3 tot = fa A + $ib- 
As /3tot increases, the temporal correlation be- 
tween Alice's and Bob's photon decreases. How- 
ever, a' cm = cr cor if (3 2 a = -Ajb = A>, 
which requires that, to a global phase, A^ = 
/ e"'^ Mlu » \ui ) {u) \duj = A B , where oj is 
the frequency detuning from the center fre- 
quency of the biphoton pulse, and \u) ) denotes 
a single photon at frequency uj p /2 + uj . There- 
fore if Alice applies normal dispersion, U A , on 
her photon, Bob can apply anomalous disper- 
sion, Ub = U A , on his photon to recover the 
temporal correlations between their photons. 

To verify the security of the DO-QKD proto- 
col, we calculate the secret-key capacity [T71 [TS] 

M = /3I(A,B)-x(A,E), (3) 

where j3 is the reconciliation efficiency, I(A, B) 
is the mutual information between Alice and 
Bob and x(A E) is Eve's Holevo information 
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about Alice's transmission [TU]. We use the co- 
variance matrix T, which is given by the ex- 
pectation values of the anti-commutators of the 
measurement operators used in our protocol 
Since the SPDC output state is Gaus- 
sian, whose low-flux limit is given in Eq. 1, 
Gaussian attacks are optimal collective attacks 
for a measured covariance matrix [THl [5T] . Ad- 
ditionally, Rcnner et al. showed that security 
against collective attacks implies asymptotic se- 
curity against the most general attacks [52] . We 
therefore calculate the secret-key capacity using 
r and assume Gaussian attacks to establish an 
upper bound on Eve's information given general 
coherent attacks. 

In our protocol, the arrival-time measure- 
ment operators are Ti = J U\U} (ti\dU, and 
the dispersed arrival-time measurement opera- 
tors are A: = g^UjfiUi, where i £ {A, B} 

and [Ta,D_a] — [Tb,Db] = %■ The covariance 
matrix can be written as 



r = 



Iaa Jab 

JBA JBB 



(4) 



where, for example, matrix ^ba describes the 
covariance between the measurements of Bob 
and Alice 20J. In the absence of excess noise, 



JAA = 



u-\-v u+v 

16 8k 

u+v (u+v)(Ak A +uv) 
8k ik 2 uv 



JAB 



JBB 



T 

IBA = 



u+v 
16 

u+v 
8k 
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u — v 
8k 
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(u+v)(ik A +uv) 
Ak 2 uv 



8k 

(u—v)(&k+uv) 
Ak 2 uv 



(5) 



where u = 16a 2 



Aa 2 cm and k = 2j3 2 L. 
Note that for large dispersion, the covariance 
matrix converges to that for frequency and 
arrival-time measurements. We require that 
the bases be conjugate to use the covariance 
matrix approach, which requires that (3 2 L 3> 
Ccohfcor- However allowing for finite <7 co h in 
the case of (3 2 a — —P2B, &% i an< 4 a coh become 



r ll2 



o-cor + (P2L/a coh ) 2 and a'£ h = a 2 coh 



(cr" or ) is significantly larger than cr co h (V cor ), in- 
creasing the time spent acquiring correlations in 
the dispersed basis. However, the effect of this 
on the data rate could be made negligibly small 
using asymmetric basis selection [23] or using 
heralding as described below. 

Following the methods employed continuous 
variable QKD (CV-QKD) protocols, we account 
for excess noise e and loss of correlations ij due 
to either Eve or the transmission channel. The 
covariance matrix becomes 



r, 



IAA (1 - Tl)lAB 

(l-vhsA (l + e)7 BB 



(G) 



(P 2 L/a cor ) , respectively. In this limit, cr" oh 



Alice's auto-covariance matrix does not depend 
on e and r\ because her setup is not accessible to 
Eve. The Holevo information can be calculated 
from the symplectic eigenvalues of r n [2"H - f2l)] . 
which we detail in the Supplemental Informa- 
tion. We then calculate I (A, B) from the time 
and dispersed-timc correlation coefficients, us- 
ing T" and D' to include noise due to jitter 
and dark counts, pessimistically taken as Gaus- 
sian distributed random variables. We thereby 
calculate AI given a lower bound on I(A,B) 
and an upper bound on x(A,E), plotting the 
results in Fig. [2j using the parameters shown 
in the plot and caption. Even with general co- 
herent attacks, Alice and Bob can still share 
a large amount of information per second us- 
ing DO-QKD. We take e = 77 = 0.1% defined 
for all d with respect to d = 64. This e corre- 
sponds to an increase in the standard deviation 
of Bob's auto-covariance elements, and r\ relates 
to a decrease in the standard deviation of Al- 
ice and Bob's joint covariance elements, both 
by roughly 1 ps. The maximum transmission 
length shown, ~ 250 km, is significantly longer 
than for CV-QKD protocols [? ], which are gen- 
erally limited to < 25 km transmission. The 
primary reason for this difference is that Eve 
cannot obtain more signal photons from Alice 
than Bob. As a result, e and r\ in our proto- 
col does not increase with loss - AI decreases 
to zero only when the probability of registering 
a dark count approaches the probability of Bob 
detecting a photon. The bit rate in our protocol 
can also be significantly higher. 
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FIG. 2: (left) Secret-key capacity as a function of 
channel length assuming a constant photon emis- 
sion rate for all coherence times; a cor — 30 ps; prop- 
agation loss q = 0.2 dB/km; detector timing jitter 
J = 20 ps; Alice and Bob system detection effi- 
ciencies of 50%; e — r\ = 0.1%; probability of dark 
counts per frame, Pd = 10 -6 ; f3 = 0.9; pair gener- 
ation rate 7„ = 1/3 GHz; expected number of pairs 
per frame assuming heralding, n = 0.6. (right) The 
secret-key capacity given the same parameters, but 
with 7„ = n/(d ■ cr cor ). The upper plots show bits 
per second, and the lower plots show bit per photon, 
i.e., bits per frame in which Alice and Bob measure 
in the same basis. 
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FIG. 3: Maximum excess noise e such that A J > 0, 
using the parameters listed in the Fig. [2] caption, 
and d = 16. 

While we have considered photons generated 
by SPDC, it may not be possible to experi- 
mentally determine the covariance matrix ele- 
ments for such a state, as Alice and Bob have no 
knowledge as to the center time of the biphoton 
envelope. Therefore, Alice and Bob could use 
a prepare-and-measure scheme, shown in Fig. 



[TJb) . In this realization, Alice directly measures 
the arrival time of her photon, sends this time to 
Bob as a synchronization pulse, and then mod- 
ulates the delay on Bob's photon to encode in- 
formation. 

In addition to enabling measurement of the 
covariance matrix, this technique allows Alice 
to increase the photon generation rate. With 
high system detection efficiency, she can de- 
termine whether multiple pairs are emitted in 
each frame and remove them with an ampli- 
tude modulator. Therefore, using this herald- 
ing and post-selection, Alice can send on the 
order of one photon per frame, while the prob- 
ability of producing multiple photons can be 
strongly suppressed. Multiphoton events in- 
crease the error rate in the presence of loss, re- 
ducing I(A,B). 

Compared to protocols employing conjugate 
bases in position-momentum [4] and energy- 
time p3 [5] , our time-bin protocol requires fewer 
detectors - as few as one detector per party 
if the beam-splitters are replaced with active 
switches, as shown in Fig. [ljb). For data rates 
exceeding that allowed by detector dead-time, 
one must use a detector array, however the num- 
ber of detectors in this array does not scale with 
the dimension of the protocol. This lower num- 
ber of detectors can increase resilience to attack 
due to a lower dark count probability. Alterna- 
tively, Alice could use an attenuated laser source 
for the protocol, applying or not applying dis- 
persion to the pulse sent to Bob. This could be 
paired with a decoy state protocol to enhance 
the secure transmission length [27] , 

The DO-QKD protocol is ideally suited 
for implementation in fiber telecommunica- 
tions networks and photonic integrated circuits, 
which are designed for multiplexed, high bit- 
rate signals. Alice could use a commercial hber 
Bragg grating, silicon photonic crystal waveg- 
uide [2S], or optical cavity For channel 
bandwidths of ~ l/<7 cor , DO-QKD can operate 
at the Heisenberg measurement limit, while for 
larger bandwidths, dense wavelength division 
multiplexing (DWDM) could be implemented to 
run hundreds of independent wavelength chan- 
nels simultaneously. 
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